[BUG] /sandbox exclude refused as "overridden by a higher-priority configuration" when the sandbox comes from --settings, even with no managed policy

What's Wrong?
When a session is started with sandbox settings passed on the command line (--settings '{"sandbox":{...}}'), /sandbox exclude <pattern> fails with:

Error: Sandbox settings are overridden by a higher-priority configuration and cannot be changed locally.

There is no managed or policy settings file on the machine. The only "higher-priority" source is the --settings flag the user passed themselves. So a wrapper script that sets a baseline sandbox per project removes the user's only in-session way to let one command out of the sandbox.

What Should Happen?
Either /sandbox exclude adds the pattern (to local settings, merged with the flag's list the way excludedCommands from different tiers are already merged), or the error names the actual source ("set by --settings") and says how to add an exclusion instead.

Steps to Reproduce

1. Make sure no managed settings exist (/Library/Application Support/ClaudeCode/ does not exist at all).
2. Run: claude --settings '{"sandbox":{"enabled":true}}'
3. In the session, type: /sandbox exclude "echo hello"
4. Observe the error above.
5. Control: quit, run plain claude (sandbox enabled in user settings instead), repeat step 3 — the exclusion is accepted.

Is this a regression? I don't know.
Claude Code Version: 2.1.286
Platform: Anthropic API
Operating System: macOS 27.0.1
Terminal/Shell: Ghostty 1.3.1 / zsh

Additional Information
Reading the 2.1.286 bundle, the check is areSandboxSettingsLockedByPolicy(); its name suggests it is meant for managed policy, but it also fires for flag settings.